CVE-2025-61163: n/a

CVE-2025-61163 describes a critical security flaw in Cohere North AI v1.1.5 where the server does not properly validate the Origin header in incoming requests. This results in an excessively permissive cross-domain policy that allows untrusted domains to bypass same-origin restrictions. The vulnerability is classified under CWE-942 (Permissive Cross-domain Policy). The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow remote attackers to perform unauthorized cross-origin requests, potentially leading to data theft, manipulation, or service disruption. The critical CVSS score reflects the high risk of full system compromise without requiring authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor vendor communications for updates and consider restricting cross-origin requests through network controls or application-layer filtering as a temporary measure.